Generating Path-Centric Traffic Information for Analysis Using an Association of Packet-Centric Information to Path-Centric Information

1. A method for generating traffic information for analysis, the method comprising: a) accepting, by a data forwarding device, at least one sample derived from addressed data; b) determining, by the data forwarding device, path-centric information based on the accepted at least one sample; and c) adjusting, by the data forwarding device, a traffic metric of a traffic parameter based on the determined path-centric information, wherein the act of determining path-centric information based on the accepted at least one sample includes using at least a part of the at least one sample as a search key to find an item with a closest matching key in a data structure.

2. The method of claim 1 wherein the data structure is a searchable data structure selected from a group consisting of (A) a hash table, (B) a binary search tree, and (C) a trie.

3. A method for generating traffic information for analysis, the method comprising: a) accepting, by a data forwarding device, at least one sample derived from addressed data; b) determining, by the data forwarding device, path-centric information based on the accepted at least one sample; and c) adjusting, by the data forwarding device, a traffic metric of a traffic parameter based on the determined path-centric information, wherein the act of determining path-centric information based on the accepted at least one sample includes: i) using at least a part of the at least one sample as a search key to find a first item with a closest matching key in a first data structure; and ii) using at least a part of the first item found as a search key to find a second item with a matching key in a second data structure.

4. The method of claim 3 wherein the second item includes path-centric information.

5. The method of claim 3 wherein the second item includes an origin autonomous system and a peer autonomous system.

6. The method of claim 3 wherein the second item includes an autonomous system path.

7. The method of claim 3 wherein the first and second data structures are tries.

8. The method of claim 3 wherein the first data structure is a Radix trie.

9. The method of claim 3 wherein the at least a part of the at least one sample used as a search key is an internet protocol prefix.

10. The method of claim 3 wherein the at least a part of the at least one sample used as a search key is at least one of (A) a source address and (B) a destination address.

11. The method of claim 3 wherein the at least a part of the first item found used as a search key is an autonomous system index.

12. A method for generating traffic information for analysis, the method comprising: a) accepting, by a data forwarding device, at least one sample derived from addressed data; b) determining, by the data forwarding device, path-centric information based on the accepted at least one sample; and c) adjusting, by the data forwarding device, a traffic metric of a traffic parameter based on the determined path-centric information, wherein the path-centric information determined includes an origin autonomous system and a peer autonomous system.

13. A method for generating traffic information for analysis, the method comprising: a) accepting, by a data forwarding device, at least one sample derived from addressed data; b) determining, by the data forwarding device, path-centric information based on the accepted at least one sample; and c) adjusting, by the data forwarding device, a traffic metric of a traffic parameter based on the determined path-centric information, wherein the path-centric information determined includes an autonomous system path.

14. A method for generating traffic information for analysis, the method comprising: a) accepting, by a data forwarding device, at least one sample derived from addressed data; b) determining, by the data forwarding device, path-centric information based on the accepted at least one sample; and c) adjusting, by the data forwarding device, a traffic metric of a traffic parameter based on the determined path-centric information, wherein the act of adjusting a traffic metric of a traffic parameter based on the determined path-centric information includes: i) using a part of the determined path-centric information as a key to search items of traffic parameters; ii) if a traffic parameter with a matching key is found, incrementing its traffic metric; iii) if none of the traffic parameters has a matching key, creating a new item.

15. A method for generating traffic information for analysis, the method comprising: a) accepting, by a data forwarding device, at least one sample derived from addressed data; b) determining, by the data forwarding device, path-centric information based on the accepted at least one sample; and c) adjusting, by the data forwarding device, a traffic metric of a traffic parameter based on the determined path-centric information, wherein the traffic metric adjusted is at least one of (A) a byte count and (B) a packet count.

16. A method for generating traffic information for analysis, the method comprising: a) accepting, by a data forwarding device, at least one sample derived from addressed data; b) determining, by the data forwarding device, path-centric information based on the accepted at least one sample; and c) adjusting, by the data forwarding device, a traffic metric of a traffic parameter based on the determined path-centric information, wherein the traffic parameter is selected from a group of traffic parameters consisting of (A) a particular pair of source and destination addresses, (B) a particular pair of source and destination ports, and (C) a particular pair of autonomous systems.

17. An apparatus for generating traffic information for analysis, the apparatus comprising: a) an input for accepting at least one sample derived from addressed data; b) means for determining path-centric information based on the accepted at least one sample; and c) means for adjusting a traffic metric of a traffic parameter based on the determined path-centric information, wherein the means for determining path-centric information based on the accepted at least one sample include a searching facility, the search facility (i) using at least a part of the at least one sample as a search key to find a first item with a closest matching key in a first data structure, and (ii) using at least a part of the first item found as a search key to find a second item with a matching key in a second data structure.

18. The apparatus of claim 17 wherein the second item includes path-centric information.

19. The apparatus of claim 17 wherein the second item includes an origin autonomous system and a peer autonomous system.

20. The apparatus of claim 17 wherein the second item includes an autonomous system path.

21. An apparatus for generating traffic information for analysis, the apparatus comprising: a) an input for accepting at least one sample derived from addressed data; b) means for determining path-centric information based on the accepted at least one sample; and c) means for adjusting a traffic metric of a traffic parameter based on the determined path-centric information, wherein the means for adjusting a traffic metric of a traffic parameter based on the determined path-centric information include i) a search facility, using a part of the determined path-centric information as a key to search items of traffic parameters; and ii) an aggregator, wherein if a traffic parameter with a matching key is found, the aggregator increments the traffic metric of the traffic parameter, and wherein if none of the traffic parameters has a matching key, the aggregator creates a new item.

22. An apparatus for generating traffic information for analysis, the apparatus comprising: a) an input for accepting at least one sample derived from addressed data; b) means for determining path-centric information based on the accepted at least one sample; and c) means for adjusting a traffic metric of a traffic parameter based on the determined path-centric information, wherein the traffic parameter is selected from a group of traffic parameters consisting of (A) a particular pair of source and destination addresses, (B) a particular pair of source and destination ports, and (C) a particular pair of autonomous systems.